FlaskBB 2.2.0__py3-none-any.whl

flaskbb/auth/forms.py

@@ -0,0 +1,170 @@
+# -*- coding: utf-8 -*-
+"""
+flaskbb.auth.forms
+~~~~~~~~~~~~~~~~~~
+
+It provides the forms that are needed for the auth views.
+
+:copyright: (c) 2014 by the FlaskBB Team.
+:license: BSD, see LICENSE for more details.
+"""
+
+import logging
+
+from flask_babelplus import lazy_gettext as _
+from wtforms import (
+    BooleanField,
+    HiddenField,
+    PasswordField,
+    SelectField,
+    StringField,
+    SubmitField,
+)
+from wtforms.validators import (
+    DataRequired,
+    Email,
+    EqualTo,
+    InputRequired,
+    regexp,
+)
+
+from flaskbb.utils.forms import FlaskBBForm, add_recaptcha_field
+
+logger = logging.getLogger(__name__)
+
+USERNAME_RE = r"^[\w.+-]+$"
+is_valid_username = regexp(
+    USERNAME_RE, message=_("You can only use letters, numbers or dashes.")
+)
+
+
+@add_recaptcha_field()
+class LoginForm(FlaskBBForm):
+    login = StringField(
+        _("Username or Email address"),
+        validators=[
+            DataRequired(message=_("Please enter your username or email address."))
+        ],
+    )
+
+    password = PasswordField(
+        _("Password"),
+        validators=[DataRequired(message=_("Please enter your password."))],
+    )
+
+    remember_me = BooleanField(_("Remember me"), default=False)
+
+    submit = SubmitField(_("Login"))
+
+
+@add_recaptcha_field(only_on_ratelimit=True)
+class RegisterForm(FlaskBBForm):
+    username = StringField(
+        _("Username"),
+        validators=[
+            DataRequired(message=_("A valid username is required")),
+            is_valid_username,
+        ],
+    )
+
+    email = StringField(
+        _("Email address"),
+        validators=[
+            DataRequired(message=_("A valid email address is required.")),
+            Email(message=_("Invalid email address.")),
+        ],
+    )
+
+    password = PasswordField(
+        _("Password"),
+        validators=[
+            InputRequired(),
+            EqualTo("confirm_password", message=_("Passwords must match.")),
+        ],
+    )
+
+    confirm_password = PasswordField(_("Confirm password"))
+
+    language = SelectField(_("Language"))
+
+    accept_tos = BooleanField(
+        _("I accept the Terms of Service"),
+        validators=[DataRequired(message=_("Please accept the TOS."))],
+        default=True,
+    )
+
+    submit = SubmitField(_("Register"))
+
+
+class ReauthForm(FlaskBBForm):
+    password = PasswordField(
+        _("Password"),
+        validators=[DataRequired(message=_("Please enter your password."))],
+    )
+
+    submit = SubmitField(_("Refresh Login"))
+
+
+@add_recaptcha_field()
+class ForgotPasswordForm(FlaskBBForm):
+    email = StringField(
+        _("Email address"),
+        validators=[
+            DataRequired(message=_("A valid email address is required.")),
+            Email(),
+        ],
+    )
+
+    submit = SubmitField(_("Request Password"))
+
+
+class ResetPasswordForm(FlaskBBForm):
+    token = HiddenField("Token")
+
+    email = StringField(
+        _("Email address"),
+        validators=[
+            DataRequired(message=_("A valid email address is required.")),
+            Email(),
+        ],
+    )
+
+    password = PasswordField(
+        _("Password"),
+        validators=[
+            InputRequired(),
+            EqualTo("confirm_password", message=_("Passwords must match.")),
+        ],
+    )
+
+    confirm_password = PasswordField(_("Confirm password"))
+
+    submit = SubmitField(_("Reset password"))
+
+
+class RequestActivationForm(FlaskBBForm):
+    username = StringField(
+        _("Username"),
+        validators=[
+            DataRequired(message=_("A valid username is required.")),
+            is_valid_username,
+        ],
+    )
+
+    email = StringField(
+        _("Email address"),
+        validators=[
+            DataRequired(message=_("A valid email address is required.")),
+            Email(message=_("Invalid email address.")),
+        ],
+    )
+
+    submit = SubmitField(_("Send Confirmation Mail"))
+
+
+class AccountActivationForm(FlaskBBForm):
+    token = StringField(
+        _("Email confirmation token"),
+        validators=[DataRequired(_("Please enter the token we have sent to you."))],
+    )
+    submit = SubmitField(_("Confirm Email"))

flaskbb/auth/plugins.py

@@ -0,0 +1,119 @@
+# -*- coding: utf-8 -*-
+"""
+flaskbb.auth.plugins
+~~~~~~~~~~~~~~~~~~~~
+Plugin implementations for FlaskBB auth hooks
+
+:copyright: (c) 2014-2018 the FlaskBB Team.
+:license: BSD, see LICENSE for more details
+"""
+
+from flask import flash, redirect, url_for
+from flask_login import current_user, logout_user
+
+from ..core.auth.authentication import ForceLogout
+from ..extensions import db
+from ..user.models import User
+from ..utils.settings import flaskbb_config
+from . import impl
+from .services.authentication import (
+    BlockUnactivatedUser,
+    ClearFailedLogins,
+    DefaultFlaskBBAuthProvider,
+    MarkFailedLogin,
+)
+from .services.factories import account_activator_factory
+from .services.reauthentication import (
+    ClearFailedLoginsOnReauth,
+    DefaultFlaskBBReauthProvider,
+    MarkFailedReauth,
+)
+from .services.registration import (
+    AutoActivateUserPostProcessor,
+    AutologinPostProcessor,
+    EmailUniquenessValidator,
+    SendActivationPostProcessor,
+    UsernameRequirements,
+    UsernameUniquenessValidator,
+    UsernameValidator,
+)
+
+
+@impl(trylast=True)
+def flaskbb_authenticate(identifier, secret):
+    return DefaultFlaskBBAuthProvider().authenticate(identifier, secret)
+
+
+@impl(tryfirst=True)
+def flaskbb_post_authenticate(user):
+    handlers = [ClearFailedLogins()]
+
+    if flaskbb_config["ACTIVATE_ACCOUNT"]:
+        handlers.append(BlockUnactivatedUser())
+
+    for handler in handlers:
+        handler.handle_post_auth(user)
+
+
+@impl
+def flaskbb_authentication_failed(identifier):
+    MarkFailedLogin().handle_authentication_failure(identifier)
+
+
+@impl(trylast=True)
+def flaskbb_reauth_attempt(user, secret):
+    return DefaultFlaskBBReauthProvider().reauthenticate(user, secret)
+
+
+@impl
+def flaskbb_reauth_failed(user):
+    MarkFailedReauth().handle_reauth_failure(user)
+
+
+@impl
+def flaskbb_post_reauth(user):
+    ClearFailedLoginsOnReauth().handle_post_reauth(user)
+
+
+@impl
+def flaskbb_errorhandlers(app):
+    @app.errorhandler(ForceLogout)
+    def handle_force_logout(error):
+        if current_user:
+            logout_user()
+            if error.reason:
+                flash(error.reason, "danger")
+        return redirect(url_for("forum.index"))
+
+
+@impl
+def flaskbb_gather_registration_validators():
+    blacklist = [
+        w.strip() for w in flaskbb_config["AUTH_USERNAME_BLACKLIST"].split(",")
+    ]
+
+    requirements = UsernameRequirements(
+        min=flaskbb_config["AUTH_USERNAME_MIN_LENGTH"],
+        max=flaskbb_config["AUTH_USERNAME_MAX_LENGTH"],
+        blacklist=blacklist,
+    )
+
+    return [
+        EmailUniquenessValidator(User),
+        UsernameUniquenessValidator(User),
+        UsernameValidator(requirements),
+    ]
+
+
+@impl
+def flaskbb_registration_post_processor(user):
+    handlers = []
+
+    if flaskbb_config["ACTIVATE_ACCOUNT"]:
+        handlers.append(SendActivationPostProcessor(account_activator_factory()))
+    else:
+        handlers.append(AutologinPostProcessor())
+        handlers.append(AutoActivateUserPostProcessor(db, flaskbb_config))
+
+    for handler in handlers:
+        handler.post_process(user)

flaskbb/auth/services/__init__.py

@@ -0,0 +1,56 @@
+# -*- coding: utf-8 -*-
+"""
+flaskbb.auth.services
+~~~~~~~~~~~~~~~~~~~~~
+Public module of implemenations of auth related services
+in FlaskBB. If you are developing a plugin or extending
+FlaskBB, you should import from this module rather than
+submodules.
+
+:copyright: (c) 2014-2018 the FlaskBB Team.
+:license: BSD, see LICENSE for more details
+"""
+
+from .activation import AccountActivator
+from .authentication import (
+    BlockTooManyFailedLogins,
+    BlockUnactivatedUser,
+    DefaultFlaskBBAuthProvider,
+    FailedLoginConfiguration,
+    MarkFailedLogin,
+    PluginAuthenticationManager,
+)
+from .factories import (
+    account_activator_factory,
+    authentication_manager_factory,
+    reauthentication_manager_factory,
+    registration_service_factory,
+    reset_service_factory,
+)
+from .password import ResetPasswordService
+from .registration import (
+    EmailUniquenessValidator,
+    UsernameRequirements,
+    UsernameUniquenessValidator,
+    UsernameValidator,
+)
+
+__all__ = (
+    "AccountActivator",
+    "account_activator_factory",
+    "authentication_manager_factory",
+    "BlockTooManyFailedLogins",
+    "BlockUnactivatedUser",
+    "DefaultFlaskBBAuthProvider",
+    "EmailUniquenessValidator",
+    "FailedLoginConfiguration",
+    "MarkFailedLogin",
+    "PluginAuthenticationManager",
+    "reauthentication_manager_factory",
+    "registration_service_factory",
+    "ResetPasswordService",
+    "reset_service_factory",
+    "UsernameRequirements",
+    "UsernameUniquenessValidator",
+    "UsernameValidator",
+)

flaskbb/auth/services/activation.py

@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*-
+"""
+flaskbb.auth.services.activation
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Handlers for activating accounts in FlaskBB
+
+:copyright: (c) 2014-2018 the FlaskBB Team
+:license: BSD, see LICENSE for more details
+"""
+
+from flask_babelplus import gettext as _
+
+from ...core.auth.activation import AccountActivator as _AccountActivator
+from ...core.exceptions import ValidationError
+from ...core.tokens import Token, TokenActions, TokenError
+from ...email import send_activation_token
+from ...extensions import db
+
+
+class AccountActivator(_AccountActivator):
+    """
+    Default account activator for FlaskBB, handles the activation
+    process through email.
+    """
+
+    def __init__(self, token_serializer, users):
+        self.token_serializer = token_serializer
+        self.users = users
+
+    def initiate_account_activation(self, email: str):
+        user = db.session.execute(
+            db.select(self.users).filter_by(email=email)
+        ).scalar_one_or_none()
+
+        if user is None:
+            raise ValidationError("email", _("Entered email doesn't exist"))
+
+        if user.activated:
+            raise ValidationError("email", _("Account is already activated"))
+
+        token = self.token_serializer.dumps(
+            Token(user_id=user.id, operation=TokenActions.ACTIVATE_ACCOUNT)
+        )
+
+        send_activation_token.delay(
+            token=token, username=user.username, email=user.email
+        )
+
+    def activate_account(self, token):
+        token = self.token_serializer.loads(token)
+        if token.operation != TokenActions.ACTIVATE_ACCOUNT:
+            raise TokenError.invalid()
+        user = db.session.execute(
+            db.select(self.users).filter_by(id=token.user_id)
+        ).scalar_one_or_none()
+        if user is None:
+            raise TokenError.invalid()
+        if user.activated:
+            raise ValidationError("activated", _("Account is already activated"))
+        user.activated = True

flaskbb/auth/services/authentication.py

@@ -0,0 +1,188 @@
+# -*- coding: utf-8 -*-
+"""
+flaskbb.auth.services.authentication
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Authentication providers, handlers and post-processors
+in FlaskBB
+
+:copyright: (c) 2014-2018 the FlaskBB Team.
+:license: BSD, see LICENSE for more details
+"""
+
+import logging
+from datetime import datetime
+from typing import TYPE_CHECKING
+
+import attr
+from flask_babelplus import gettext as _
+from pytz import UTC
+from werkzeug.security import check_password_hash
+
+from ...core.auth.authentication import (
+    AuthenticationFailureHandler,
+    AuthenticationManager,
+    AuthenticationProvider,
+    PostAuthenticationHandler,
+    StopAuthentication,
+)
+from ...extensions import db
+from ...user.models import User
+from ...utils.helpers import time_utcnow
+
+if TYPE_CHECKING:
+    from flask_sqlalchemy.session import Session
+
+    from flaskbb.plugins.manager import FlaskBBPluginManager
+
+logger = logging.getLogger(__name__)
+
+
+@attr.s(frozen=True)
+class FailedLoginConfiguration(object):
+    """
+    Used to configure how many failed logins are accepted until an account
+    is temporarily locked out and how long to temporarily lock the account
+    out for.
+    """
+
+    limit = attr.ib()
+    lockout_window = attr.ib()
+
+
+class BlockTooManyFailedLogins(AuthenticationProvider):
+    """
+    Pre authentication check to block a login from an account that has too
+    many failed login attempts in place.
+    """
+
+    def __init__(self, configuration):
+        self.configuration = configuration
+
+    def authenticate(self, identifier, secret):
+        user = db.session.execute(
+            db.select(User).filter(
+                db.or_(User.username == identifier, User.email == identifier)
+            )
+        ).scalar_one_or_none()
+
+        if user is not None:
+            attempts = user.login_attempts
+            last_attempt = user.last_failed_login or datetime.min.replace(tzinfo=UTC)
+            reached_attempt_limit = attempts >= self.configuration.limit
+            inside_lockout = (
+                last_attempt + self.configuration.lockout_window
+            ) >= time_utcnow()
+
+            if reached_attempt_limit and inside_lockout:
+                raise StopAuthentication(
+                    _(
+                        "Your account is currently locked out due to too many "
+                        "failed login attempts"
+                    )
+                )
+
+
+class DefaultFlaskBBAuthProvider(AuthenticationProvider):
+    """
+    This is the default username/email and password authentication checker,
+    locates the user based on the identifer passed -- either username or email
+    -- and compares the supplied password to the hash connected to the matching
+    user (if any).
+
+    Offers protection against timing attacks that would rely on the difference
+    in response time from not matching a password hash.
+    """
+
+    def authenticate(self, identifier: str, secret: str):
+        user = db.session.execute(
+            db.select(User).filter(
+                db.or_(User.username == identifier, User.email == identifier)
+            )
+        ).scalar_one_or_none()
+
+        if user is not None:
+            if check_password_hash(user.password, secret):
+                return user
+            return None
+
+        check_password_hash("dummy password", secret)
+        return None
+
+
+class MarkFailedLogin(AuthenticationFailureHandler):
+    """
+    Failure handler that marks the login attempt on the user and sets the
+    last failed date when it happened.
+    """
+
+    def handle_authentication_failure(self, identifier: str):
+        user = db.session.execute(
+            db.select(User).filter(
+                db.or_(User.username == identifier, User.email == identifier)
+            )
+        ).scalar_one_or_none()
+
+        if user is not None:
+            user.login_attempts += 1
+            user.last_failed_login = time_utcnow()
+
+
+class BlockUnactivatedUser(PostAuthenticationHandler):
+    """
+    Post auth handler that will block a user that has managed to pass the
+    authentication check but has not actually activated their account yet.
+    """
+
+    def handle_post_auth(self, user: "User"):
+        if not user.activated:  # pragma: no branch
+            raise StopAuthentication(
+                _(
+                    "In order to use your account you have to "
+                    "activate it through the link we have sent to "
+                    "your email address."
+                )
+            )
+
+
+class ClearFailedLogins(PostAuthenticationHandler):
+    """
+    Post auth handler that clears all failed login attempts from a user's
+    account.
+    """
+
+    def handle_post_auth(self, user: "User"):
+        user.login_attempts = 0
+
+
+class PluginAuthenticationManager(AuthenticationManager):
+    """
+    Authentication manager relying on plugin hooks to manage the authentication
+    process. This is the default authentication manager for FlaskBB.
+    """
+
+    def __init__(self, plugin_manager: "FlaskBBPluginManager", session: Session):
+        self.plugin_manager = plugin_manager
+        self.session = session
+
+    def authenticate(self, identifier: str, secret: str):
+        try:
+            user = self.plugin_manager.hook.flaskbb_authenticate(
+                identifier=identifier, secret=secret
+            )
+            if user is None:
+                raise StopAuthentication(_("Wrong username or password."))
+            self.plugin_manager.hook.flaskbb_post_authenticate(user=user)
+            return user
+        except StopAuthentication:
+            self.plugin_manager.hook.flaskbb_authentication_failed(
+                identifier=identifier
+            )
+            raise
+        finally:
+            try:
+                self.session.commit()
+            except Exception:
+                logger.exception("Exception while processing login")
+                self.session.rollback()
+                raise

flaskbb/auth/services/factories.py

@@ -0,0 +1,52 @@
+# -*- coding: utf-8 -*-
+"""
+flaskbb.auth.services.factories
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Factory functions for various FlaskBB auth services
+
+These factories are provisional.
+
+:copyright: 2014-2018 the FlaskBB Team.
+:license: BSD, see LICENSE for more details
+"""
+
+from datetime import timedelta
+
+from flask import current_app
+
+from ...extensions import db, pluggy
+from ...tokens import FlaskBBTokenSerializer
+from ...tokens.verifiers import EmailMatchesUserToken
+from ...user.models import User
+from .activation import AccountActivator
+from .authentication import PluginAuthenticationManager
+from .password import ResetPasswordService
+from .reauthentication import PluginReauthenticationManager
+from .registration import RegistrationService
+
+
+def registration_service_factory():
+    return RegistrationService(pluggy, User, db)
+
+
+def reset_service_factory():
+    token_serializer = FlaskBBTokenSerializer(
+        current_app.config["SECRET_KEY"], expiry=timedelta(hours=1)
+    )
+    verifiers = [EmailMatchesUserToken(User)]
+    return ResetPasswordService(token_serializer, User, token_verifiers=verifiers)
+
+
+def account_activator_factory():
+    token_serializer = FlaskBBTokenSerializer(
+        current_app.config["SECRET_KEY"], expiry=timedelta(hours=1)
+    )
+    return AccountActivator(token_serializer, User)
+
+
+def authentication_manager_factory():
+    return PluginAuthenticationManager(pluggy, db.session)
+
+
+def reauthentication_manager_factory():
+    return PluginReauthenticationManager(pluggy, db.session)